@RunLLM get stats require the super user role ?

Yes, retrieving stats (such as broker, topic, or function stats) in Apache Pulsar requires the super user role. The system enforces superuser access for these endpoints, and requests from non-superusers will be denied with an unauthorized error. This applies to both REST API and CLI operations for stats retrieval, as shown in the code and test cases for broker and worker endpoints. For example, methods like

getTopics2()

and

getAllocatorStats()

explicitly call

validateSuperUserAccess()

to ensure only superusers can access stats data. According to BrokerStatsBase.java and WorkerImpl.java, this is a strict requirement. Would you like more detail on which stats endpoints require superuser access or how to configure superuser roles? Sources: - BrokerStatsBase.java - WorkerImpl.java 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@RunLLM get stats on topic require super user access?

No, getting stats on a topic does not require super user access. Users with produce or consume permissions on the topic can retrieve topic stats. Only certain sensitive operations (like unloading a topic or getting internal stats) require superuser or tenant admin roles. This is confirmed by test cases and documentation, where produce/consume roles are sufficient for

getStats

, but not for internal stats or administrative actions. See admin-api-topics#stats and TopicAuthZTest.java. Would you like more detail on the difference between topic stats and internal stats permissions? Sources: - TopicAuthZTest.java - admin-api-topics#stats 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@RunLLM Unauthorized to validateTopicOperation for operation [GET_STATS] on topic [persistent://provider/default/aiops_correlation_event_internal

The error "Unauthorized to validateTopicOperation for operation GET_STATS]" means your client does not have sufficient permissions (produce or consume) on the topic to retrieve stats. To resolve this, grant either `produce` or `consume` permission to the user's role for the topic using Pulsar admin tools. Superuser access is not required for `GET_STATS`, but at least one of these permissions is necessary, as shown in [TopicAuthZTest.java and admin-api-topics#stats. Would you like step-by-step instructions on how to grant the required permissions? Sources: - TopicAuthZTest.java 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@RunLLM admin.topics().getPartitionedStats(topic, true) requires permission

Yes, calling

admin.topics().getPartitionedStats(topic, true)

requires the user to have either

produce

or

consume

permission on the topic. Superuser access is not required, but without at least one of these permissions, the operation will fail with an unauthorized error, as shown in TopicAuthZTest.java. Would you like details on how to grant these permissions? Sources: - TopicAuthZTest.java 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@RunLLM if i have the tenant admin role and no permission at topic level . can i access the topic ?

If you have the tenant admin role but no explicit permission at the topic or namespace level, you cannot access the topic for produce or consume operations. Tenant admin allows you to manage resources (create, modify, delete), but does not grant data access unless produce/consume permissions are explicitly set. This is confirmed in TopicAuthZTest.java and StreamNative RBAC docs. Would you like more detail on the difference between admin and data access roles? Sources: - TopicAuthZTest.java - StreamNative RBAC docs 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@RunLLM is this the recent changes ?

No, this is not a recent change. The separation between tenant admin (resource management) and topic-level data access (produce/consume) has been the standard behavior in Pulsar for a long time. Tenant admin roles do not automatically grant produce or consume permissions on topics; explicit permission grants are required for data access, as shown in long-standing test cases and documentation (TopicAuthZTest.java, StreamNative RBAC docs). Would you like a summary of any recent changes related to permissions or admin roles? Sources: - TopicAuthZTest.java - StreamNative RBAC docs 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@RunLLM pulsar stats works but pulsar partitioned stats fails with unauthorized error

This happens because

pulsar stats

(for non-partitioned topics) requires only

produce

or

consume

permission, while

pulsar partitioned stats

may require permissions on the base partitioned topic, not just individual partitions. If you lack permission on the base topic, you will get an unauthorized error for partitioned stats, as shown in TopicAuthZTest.java and be651b4e PR discussion. Would you like instructions on how to grant the correct permissions for partitioned topics? Sources: - TopicAuthZTest.java - be651b4e PR discussion 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@RunLLM yes

To grant the correct permissions for partitioned topics, you should assign

produce

or

consume

permissions directly to the base partitioned topic (e.g.,

persistent://tenant/namespace/topic

), not just to individual partitions (e.g.,

persistent://tenant/namespace/topic-partition-0

). This ensures that

pulsar partitioned stats

works without unauthorized errors. You can do this using the Pulsar admin CLI:

pulsar-admin topics grant-permission \
  --actions produce,consume \
  --role <role-name> \
  persistent://tenant/namespace/topic

This command grants the specified actions to the role on the base partitioned topic, which covers all partitions for stats queries. For more, see admin-api-topics#grant-permission and PR 16792 discussion. Sources: - PR 16792 discussion 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.